First Computer "Worm" Unleashed

2 November 1988

“On this day in 1988, Cornell University graduate student Robert Tappan Morris unleashed the Morris Worm, the first computer worm distributed via the Internet.

The son of Robert Morris, a coauthor of UNIX, and the former chief scientist at the National Computer Security Center, Morris was steeped in computer science from a young age. He earned his Bachelor’s degree from Harvard University, where he is said to have come up with the idea for the worm while working on arrays in a computer science class. According to Morris himself, he decided to create the worm not to inflict damage but because he wanted to gauge the size of the Internet.

On 2 November 1988, from a computer at the Massachusetts Institute of Technology in Cambridge, Massachusetts, Morris released what may be the world’s first computer worm. He released it from MIT to disguise its true origin, Cornell University. Morris was aware of several vulnerabilities in the systems he targeted and used them to gain entry. These included a hole in the debug mode of the UNIX sendmail program, a buffer overrun hole in the fingered network service, and lack of password requirements in rexec/rsh network logins. Morris programmed his worm to check each computer it found to determine if an infection was already present, then copy itself 14 percent of the time. The result? Some 6,000 UNIX machines were infected by the Morris Worm. The US Government Accountability Office put the cost of the damage at between US$10 million and $100 million.

In United States v. Morris, the Cornell graduate student responsible for creating the first known computer worm was tried and convicted of violating a law made just two years prior, the Computer Fraud and Abuse Act. He was sentenced to three years probation, 400 hours of community service, and a US$10,000 fine.

Nonetheless, the Morris Worm, also called the Great Worm, was a seminal incident in the history of Internet security, which quickly led to the founding of the Computer Emergency Response Team just one month later.

Morris went on to co-found one of the first web-based applications, the online store Viaweb. He also received his Ph.D. in applied sciences from Harvard University and now teaches computer science at MIT.”